HIPAA Privacy Rule Positive Changes Affecting Hospitals’ Implementation of the Rule

The purpose... is to maintain strong protections for the privacy of individually identifiable health information while clarifying certain of the Privacy Rule’s provisions, addressing the unintended negative effects of the Privacy Rule on health care quality or access to health care, and relieving unintended administrative burdens created by the Privacy Rule. Final Rule, August 14, 2002 The Final Rule: Changes

Written acknowledgment replaces written consent Disclosure allowed for other covered entities’ treatment, payment and some health care operations Incidental disclosures are not privacy rule violations Authorized disclosures exempt from accounting requirement The Final Rule: Positive Changes for Hospitals

Creation of limited data set and clarification of de-identification safe harbor Business associate compliance delayed for up to one year for certain existing contracts The Final Rule: Positive Changes for Hospitals (cont.)

“The notice acknowledgment process is intended to alert individuals to the importance of the notice and provide them the opportunity to discuss privacy issues with their providers.” Flexibility in designing the process Good faith effort required (HHS’s promise re “good faith”: future guidance through FAQs or other materials in response to specific scenarios raised by field) Not required in emergency situations Option to get consent remains and providers have “complete discretion in designing the consent process” Written acknowledgment replaces written consent

“The proposal would broaden the uses and disclosures that are permitted without authorization as part of treatment, payment, and health care operations so as not to interfere inappropriately with access to quality and effective health care, while limiting this expansion in order to continue to protect the privacy expectations of the individual.” PHI must pertain to the relationship Allowed where other covered entity’s relationship is past relationship Limits scope of health care operations of other covered entity for which PHI may be so used or disclosed Allows disclosures to or by a business associate Disclosures allowed for other covered entities’ treatment, payment and some health care operations

“The Privacy Rule must not impede essential health care communications and practices. Prohibiting all incidental uses and disclosures would have a chilling effect on normal and important communications among providers, and between providers and their patients, and, therefore, would negatively affect individuals’ access to quality health care.” Secondary use or disclosure that cannot reasonably be prevented, is limited in nature, and that occurs as a by- product of an otherwise permitted use or disclosure Any permissible use or disclosure made to any person Must still apply appropriate safeguards (§ (c)), and minimum necessary requirements (§§ (b), (d)) No need to include in accounting of disclosures Incidental disclosures are not privacy rule violations

“[A]ccounting for authorized disclosures d[oes] not serve to add to the individual’s knowledge about disclosures of protected health information.” Also exempt from minimum necessary requirements Authorized disclosures exempt from accounting requirement

“We have created the limited data set option because we believe that this mechanism provides a way to allow important research, public health and health care operations activities to continue in a manner consistent with the privacy protections of the Rule.” Limited data set of “facially de-identified” data (admission and discharge dates, service dates, date of death, date of birth, 5-digit zip codes) Requires “data use agreement” with recipient of data Re-identification codes or other means of record identification permitted by § (c) expressly excepted from the listed safe harbor identifiers Age now may be in months, days and hours Creation of limited data set and clarification of de-identification safe harbor

“The transition provisions are intended to address the concerns... that the two-year period between the effective date and compliance date... is insufficient to reopen and renegotiate all existing contracts... [to] bring[ ] them into compliance with the Rule. These provisions also provide covered entities with added flexibility to incorporate the business associate contract requirements at the time they would otherwise modify or renew the existing contract.” Must be a writing prior to effective date of modification Applies only to those not renewed (other than automatically) or modified between 10/14/02 and 4/14/04 New sample language provided Business associate compliance delayed for up to one year for certain existing contracts

Not relieved of the responsibilities : to make information held by a business associate available to the Secretary respecting individual’s rights (access, amend, accounting of disclosures Required to mitigate, to the extent practicable, any harmful effect known of a use or disclosure of protected health information by its business associate (§ (f)) Business associate compliance delayed for up to one year for certain existing contracts (cont.)

Fundraising restrictions remain unchanged Business associate agreement still required between two covered entities HHS declines to provide a business associate certification process Sample business associate language continues to include some optional provisions that hospitals may not want to include in their business associate agreements The Final Rule: Some Disappointments

No mitigation for covered entities’ liability and individual rights obligations with regard to their business associates during “deemed compliance” period HHS declines to exempt disclosures for public health and health oversight purposes from the accounting of disclosures requirement The Final Rule: Some Disappointments (cont.)

AHA urging phase-in of enforcement First 2 years after compliance date HHS to focus on education and technical assistance, not fines and penalties Congressional interest in phase-in approach Letter from Rep. Hobson (R-OH) to HHS Secretary Thompson dated July 15, 2002 Compliance = April 14, 2003

Currently proposed only HHS’s latest promise on publication: October 2002 No potential conflict between of privacy and security requirements (Preamble, Final Rule, August 14, 2002) Security Rule will apply only to electronic health information systems HHS, in preparing final Security Rule, is working to ensure it works “hand in glove” with Privacy Rule requirements A Word on the Security Rule